Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSSEC KSK rollover breaks DNS resolution for .nz domains

status.internetnz.nz

Post reply on HN
Print view View original

161–170 of 181 posts

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#161

Post by hsbauauvhabzb »

bawolff wrote: post #39
hsbauauvhabzb wrote: post #32

In 2020 I scraped fortune top 500 companies for dnssec and found iirc one domain using dnssec. It certainly feels like the wrong way of solving problems (ramming more into the domain registry always seems like a bad option). Is the technology dead or destined to fail? Edit: rationale: dnssec solves domain validity, but https tls solves almost the same problem but has better backing (azure said they don’t support dnss…

> Dnssec also does not solve bgp hijacking This seems like a pretty unreasonable complaint. Dnssec also doesn't stop phishing. Or nukes.

What does dnssec solve then?

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#162

Post by hsbauauvhabzb »

tptacek wrote: post #146
belorn wrote: post #140

Earlier quoted context omitted.

DNSSEC does actually have protection against bgp hijacking. The dnssec root key are (generally?) hardcoded into the resolvers, so even if someone would do a bgp hijacking of the root servers they would still not resolve.

Who cares? If you control BGP, you control the meaning of the IP addresses DNS resolves to.

You’re also relying on the client validating DNSSec. I have no idea if/how/when this occurs, or if you can choose to ignore it.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#163

Post by belorn »

tptacek wrote: post #146
belorn wrote: post #140

Earlier quoted context omitted.

DNSSEC does actually have protection against bgp hijacking. The dnssec root key are (generally?) hardcoded into the resolvers, so even if someone would do a bgp hijacking of the root servers they would still not resolve.

Who cares? If you control BGP, you control the meaning of the IP addresses DNS resolves to.

If the attacker bgp hijacks the record target they need to also bgp hijack the authoritative server that holds the TLSA record (which the client could verify during an attack).

If the attacker want to bgp hijack the authoritative server they will need to bgp hijack the TLD name servers that holds the DS posts for the authoritative server.

If the attacker want to bgp hijack the TLD name servers they will need to bgp hijack the root server that holds the DS posts for the TLD name servers. This they can't do because the root servers keys are hard coded into revolvers.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#164

Post by belorn »

tptacek wrote: post #143
belorn wrote: post #118

Earlier quoted context omitted.

If the issue is the lack of certificate transparency, then add that as a new standard to dnssec. Certificate Transparency came into the picture around 2013, by which time https was fairly old. Public resolvers like google, quad 9, and cloudflare could create Certificate Transparency for dnssec today if there was a demand for it.

I've explained several times on this thread already why DNSSEC won't ever get transparency logging.

You said that registrars won't implement transparency logging, but certificate transparency was not created by certificate authoritative. Google added it to chrome, and they could just as easy add it to their own public resolver.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#165

Post by tptacek »

teddyh wrote: post #160
tptacek wrote: post #147

Earlier quoted context omitted.

You trust your browser's root program, not "all CAs".

That’s what a “CA” is . If someone is not in a browser’s CA list, they’re not a CA. So yes, you do trust all CAs.

No, obviously, different TLS programs have different root programs.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#166

Post by tptacek »

belorn wrote: post #163
tptacek wrote: post #146

Earlier quoted context omitted.

Who cares? If you control BGP, you control the meaning of the IP addresses DNS resolves to.

If the attacker bgp hijacks the record target they need to also bgp hijack the authoritative server that holds the TLSA record (which the client could verify during an attack). If the attacker want to bgp hijack the authoritative server they will need to bgp hijack the TLD name servers that holds the DS posts for the authoritative server. If the attacker want to bgp hijack the TLD name servers they will need to bgp h…

None of this matters. An attacker who controls BGP controls IP routing. They can defeat ACME.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#167

Post by matthew9219 »

tptacek wrote: post #158
matthew9219 wrote: post #157

Earlier quoted context omitted.

Of course it does. CT trust relies on root programs removing bad CAs and root programs and security researchers sharing information about bad CAs with root programs. The root programs, CA, and security researchers are colloquially "the CA community".

This kind of handwaving summary would be more credible if it hadn't been preceded by a long thread where it was made clear you didn't understand how CT functioned, at, like, a very basic level. You entered this conversation stridently equating CT monitoring with things like revocation checking. I'm not looking for a debate; I'm just calling out things you say that are misleading and moving on. You're welcome to dispu…

You are looking for a debate, I think. It's the whole thread. You're nerd sniping. It's classic.

You're not a fan of DNSSEC and prefer CT. When faced with examples where CT doesn't cut it, you refuse to discuss the big picture, pounce on incorrect details, and then resort to claiming your opponents are uninformed or arguing in bad faith.

The bottom line is my original big picture claim, the part that's on-topic for the article - that CT works for browsers on personal computers but not other classes of internet connected devices - it's true! And you know it! But you'd rather debate the details than inform readers about what they actually want to know (the big picture - i.e. that DNSSEC is useful).

I've observed your behavior before on hacker news, but experiencing it directly is eye opening.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#168

Post by acdha »

teddyh wrote: post #160
tptacek wrote: post #147

Earlier quoted context omitted.

You trust your browser's root program, not "all CAs".

That’s what a “CA” is . If someone is not in a browser’s CA list, they’re not a CA. So yes, you do trust all CAs.

That’s not all what CA means in standard usage. Terms like WebPKI exist specifically to make that distinction since, for example, the U.S. government runs its own certificate authorities which are trusted by millions of clients and even some mainstream software (Adobe) but not browsers. This is far from unique as far as governments go, and in some cases may even be required within a country.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#169

Post by tptacek »

matthew9219 wrote: post #167
tptacek wrote: post #158

Earlier quoted context omitted.

This kind of handwaving summary would be more credible if it hadn't been preceded by a long thread where it was made clear you didn't understand how CT functioned, at, like, a very basic level. You entered this conversation stridently equating CT monitoring with things like revocation checking. I'm not looking for a debate; I'm just calling out things you say that are misleading and moving on. You're welcome to dispu…

You are looking for a debate, I think. It's the whole thread. You're nerd sniping. It's classic. You're not a fan of DNSSEC and prefer CT. When faced with examples where CT doesn't cut it, you refuse to discuss the big picture, pounce on incorrect details, and then resort to claiming your opponents are uninformed or arguing in bad faith. The bottom line is my original big picture claim, the part that's on-topic for t…

It is difficult to make any sense out of your claim that internet connected devices can't benefit from CT. The initial claim you made was based on the unreliable connectivity and update channels of those devices, neither of which are especially implicated in enforcing CT --- your belief was that devices went and checked CT logs over the Internet on the fly to validate certificates, which, of course, no.

Ironically, this actually is a problem for DNSSEC validation! It's the literal reason why Chrome pulled its original DNSSEC/DANE implementation from the browser.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#170

Post by tptacek »

belorn wrote: post #164
tptacek wrote: post #143

Earlier quoted context omitted.

I've explained several times on this thread already why DNSSEC won't ever get transparency logging.

You said that registrars won't implement transparency logging, but certificate transparency was not created by certificate authoritative. Google added it to chrome, and they could just as easy add it to their own public resolver.

And then what happens? Google stops resolving .COM names? I don't think you've thought this through all the way.
Post reply on HN